Privacy Notice

1. Introduction

1.1       This Privacy Notice sets out the basis on which we use personal data in the course of our business activities.

1.2       We are SRL Asset Management Trading As Beyond Lettings, a company registered in England & Wales under company number 10126101. Our registered office is Beech House 78 Cleasby Road, Menston, Ilkley, England, LS29 6HN and our address for correspondence is 80 Brudenell Road, Leeds, LS6 1EG.

1.3       We reserve the right to update this Privacy Notice from time to time. Where appropriate, we shall contact you to notify you of any material changes to the Privacy Notice. You should also refer to our website periodically so that you may access and view our updated Privacy Notice. This will ensure that you understand (i) how we are using your personal data and (ii) your legal rights around our usage of such personal data.

2. Who Should Read This Privacy Notice?

2.1       This Privacy Notice applies to any living, identifiable individuals about whom we may process personal data in the course of our business activities. You should read this Privacy Notice if you are a:

• Tenant (prospective or current)
• Guarantor
• Landlord
• Supplier Representative

2.2 If you are an employee, you should refer to our Internal Privacy Notice instead which can be found in the Employee Handbook.

2.3       The purposes for which we process personal data will be informed to data subjects –

• Within our written application or registration forms;
• Within our written Pre-Tenancy and Tenancy Agreements;
• On our Website;
• Verbally at the time information is taken;
• As soon as possible after collection where it is obtained from a third party

3. How we obtain your personal data

We obtain personal data from several sources, depending on whether you are a Tenant, a Guarantor, Landlord or a Supplier Representative.

3.1       If you are a Tenant, we may obtain personal data relating to you:

• Directly if you have:
  • requested details of a property or requested a viewing through us via telephone, email or by completing a form on our website
  • engaged with us through any networking activities or events
• Indirectly from:
  • Letting agencies, third party website and portals that you have contacted to view one of our properties such as Rightmove or Spareroom
  • Social networking sites such as Facebook or Instagram

3.2       If you are a Guarantor, we may obtain personal data relating to you:

• Directly from a tenant applying for one of our properties

3.3       If you are a Landlord or Supplier Representative, we may obtain personal data relating to you:

• Directly in the course of (i) us providing services to you or (ii) you providing services to us, as applicable; or
• Indirectly from:
  • online professional networking sites such as LinkedIn
  • your employer’s website and other industry-related websites
  • business information directories
  • other individuals within your organisation in the course of (i) us providing services to you or (ii) you providing services to us, as applicable.

4. Types of Information We Hold

4.1       If you are a Tenant or Guarantor, we may collect, store and process the following types of personal information about you:

• Personal contact details such as name, title, addresses, telephone numbers, and email addresses;
• Your date of birth, nationality and place of residence;
• Employment information such as name and address of your employer
• Educational details such as your university or college course undertaken
• Proof of your right to rent in the United Kingdom such as copies of your passport and, where applicable, visa, residence permit or similar government documents;
• Proof of your identity and address, such as copies of your driving licence, utility bills or similar documents;
• Tenancy details including but not limited to: deposits, renewals, joint tenants, other residents, rent and other payments, Insurance, Council Tax and other utility bills, repairs/health and safety/housing conditions, complaints, breach of tenancy terms/nuisance/anti-social behaviour

We do not collect, store or use any “special categories” of sensitive personal information if you are a Tenant or Guarantor.

4.2       If you are a Landlord, we will collect, store, and use the following categories of personal information about you:

• Personal contact details such as name, title, addresses, telephone numbers, and email addresses;
• Your bank details;
• Property details such as rental values, full details of the properties and photographs for marketing purposes, alarm codes and other security information;
• Proof of your identity and address, such as copies of your driving licence, utility bills or similar documents;
• Copies of appropriate documents to confirm home address;
• Copies of appropriate documents to confirm ownership of property to be marketed;

We do not collect, store or use any “special categories” of sensitive personal information if you are a Client.

4.3 If you are a Supplier Representative, we will collect, store, and use the following categories of personal information about you:

• Personal contact details such as name, title, addresses, telephone numbers, and email addresses;
• Your job title and position within the Supplier organisation; and
• Any background information relating to the role which you perform within the Supplier which you may provide to us in the course of your dealings with us.

We do not collect, store or use any “special categories” of sensitive personal information if you are a Supplier Representative.

5. How We Use Personal Data

5.1 If you are a Tenant or Guarantor, we may use your personal data to:

• Assess and verify your potential suitability as a Tenant/Guarantor
• Contact you in relation to any suitable properties;
• To perform contractual obligations;
• Where applicable, make payments to you;
• Produce anonymised statistical data;
• Comply with our legal obligations, defend or bring any legal proceedings and prevent fraud or any other crime; and

5.2 If you are a Client/Landlord, we may use your personal data to:

• Liaise with you so that we may effectively perform the services required;
• Contact you for invoicing and credit control purposes;
• Comply with our legal obligations, defend or bring any legal proceedings and prevent fraud or any other crime.

5.3 If you are a Supplier Representative, we may use your personal data to:

• Liaise with you in respect of the service which is being provided by the Client;
• Contact you in relation to billing matters;
• Comply with our legal obligations, defend or bring any legal proceedings and prevent fraud or any other crime.

6. Our Lawful Basis for Processing Data

6.1       We have undertaken an audit of the data that we store, and how it is used, and have determined that our lawful basis’s for processing personal data are:

• Contractual: for the performance of our contract with you or to take steps at your request before entering into a contract;
• Legitimate interests: for our legitimate interests or those of a third party. A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests.
• Legal obligation: to comply with our legal and regulatory obligations
• Consent: where you have given your consent to be contacted for marketing purposes

6.2 The various purposes for which it may be necessary for us to process various categories of your information can be found in the Privacy Notice Appendix 1

6.3 We may change the purposes where this is compatible for the purpose for which we obtained the data originally. If we need to use your data for a non-compatible purpose, we will notify you and explain the legal gateway that allows us to do so. We may process your information without your knowledge where this is required or permitted by law.

7. Where We Process Personal Data

7.1       Your personal data is primarily held and processed by us in the United Kingdom.

7.2       We use commercial-grade cloud storage services (Microsoft OneDrive, Elevate, Adobe Sign) to store personal data relating to you. These are international businesses which may securely process data anywhere in the world. They do not perform any other form of processing on our behalf and are not entitled to use any personal data which is controlled by us for any other purpose.

7.3       We have put in place appropriate safeguards to ensure that your data is only transferred to jurisdictions with enforceable data subject rights and effective legal remedies in respect of data privacy breaches. In addition, we will only transfer personal data to jurisdictions outside of the EEA where:

• There are binding corporate rules in place regarding the transfer of such data within the Group, in accordance with Article 47 of the GDPR;
• The European Commission has made an adequacy decision in respect of such jurisdiction;
• The transfer of data is subject to the model contractual clauses adopted by the European Commission; or
• You have consented to the transfer of such data.

8. Parties with Whom We May Share Data

8.1       If you are a Tenant/Guarantor, we may share your personal data with:

• A Landlord where you have expressed an interest in renting one of their properties;
• A joint Tenant/Guarantor where you have a tenancy jointly with someone else or there is a guarantor for your tenancy. This relates to your performance of your responsibilities under the tenancy agreement including information about any rent arrears or other breach of the tenancy terms. It can also relate to issues around the termination of the tenancy and any claims we may have as a result.
• A third-party service provider to which you have specifically asked to be introduced or referred, such as a utilities provider
• A third-party service provider required to perform contractual obligations such as maintenance and repair, or a safety deposit scheme
• Governmental departments and agencies where we are permitted or required by law to do so.

8.2       If you are a Landlord, we may share your personal data with Third-Party Services Providers for legitimate business purposes.

8.3       If you are a Supplier Representative, we will share your personal data with other Third-Party Service Providers for legitimate business purposes.

8.4       What we share will depend on what is necessary in the circumstances and more details are given in the Privacy Notice Appendix 2 in respect of different kinds of information which we hold about you.

9. Automated Decision Making

9.1       Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention.

9.2       All decisions which are made in the course of our business processes involve human intervention. We do not therefore expect to make any decisions about you using automated means, whether you are a Tenant, Guarantor, Landlord or Supplier Representative.

10. Data Security

10.1     We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality. Details of these measures may be obtained from the Data Protection Manager.

10.2     We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

11. Data Retention

11.1     We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

11.2     To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

11.3     Where we have entered into a contractual agreement with you, we will retain your personal data for the duration of the contract and for seven years after the contract has ended. This is the statutory limitation period six years plus a further year to allow for service of proceedings should proceedings commence later.

11.4     Where we are required to keep any information (i) for auditing or compliance purposes (ii) to comply with our contractual obligations to third parties or (iii) in respect of any potential or actual legal proceedings, we shall keep your data for as long as is strictly necessary for these purposes, which is typically for six years from the date on which the relevant business activities were carried out.

11.5     In some circumstances we may completely anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

12. Our Website

12.1     If you interact with our website at www.beyond-lettings.co.uk, we may process information pertaining to such usage. For further information, please refer to our Website Privacy Policy & Cookie Notice at www.beyond-lettings.co.uk.

13. Rights of access, correction, erasure, and restriction

13.1     Your duty to inform us of changes. It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

13.2     Your rights in connection with personal information. Under certain circumstances, you have the right under the Data Protection Legislation to:

• Request access to your personal information (a Subject Access Request). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. You will not usually have to pay a fee to access your personal information but we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed or you have objected to the processing and there is no overriding legitimate interest for continuing the processing.
• Object to processing of your personal information where we are relying on a legitimate interest and you object on “grounds relating to your particular situation.”
• Request the restriction of processing of your personal information. This enables you to ask us to block or suppress the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it or if you have also objected to the processing as above.
• Request the transfer of your personal information to another party when the processing is based on consent and carried out by automated means.

13.3     If you want to exercise any of the above rights, please contact the Data Protection Manager in writing. We will consider your request and confirm the actions which we have taken in response to such request.

13.4     We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is an appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

13.5     In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Data Protection Manager. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law. We will confirm the actions which we have taken in respect of any such request.

13.6     If you are unhappy with any aspect of the manner in which we have processed your personal data or dealt with your decision to exercise any of the rights set out in this section, you have the right to complain to the Information Commissioners Office in the United Kingdom. Their details are:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Tel: 0303 123 1113 (local rate) or, if you prefer to use a national rate number, 01625 545 745

Email: casework@ico.org.uk

14. Definitions

Tenant means a person who is registered with Beyond as seeking or potentially seeking new accommodation. This includes individuals who are not actively seeking a new property but who would like to remain in contact with Beyond about potential properties which may be of interest from time to time.

Guarantor means a person that agrees to be responsible for a Tenant’s rental debt under a contract, if the Tenant fails to pay

Landlord means a business which has engaged Beyond Lettings to manage the letting and/or maintenance of their property

Data Protection Legislation means (i) unless and until the GDPR is no longer directly applicable in the UK, the General Data Protection Regulation ((EU) 2016/679) and any national implementing laws, regulations and secondary legislation, as amended or updated from time to time, in the UK and then (ii) any successor legislation to the GDPR or the Data Protection Act 1998.

Supplier means a business which provides services to Beyond Lettings and which may process personal data relating to any Tenant, Guarantor, Client, Landlord or Supplier Representative in the course of performing such services.

Supplier Representative means a person who is employed or engaged by a Supplier and with whom Beyond may liaise from time to time in respect of the services which are provided by that Supplier.

Third-Party Services Provider means any relevant third-party business which provides services to us, such as our:

• Professional advisers including accountants, tax advisors and lawyers
• Insurers;
• IT services providers and software providers;
• Independent consultants and subcontractors

15. Further Information and Contacting Us

15.1     For more information about what we do with data and why, and who we share data with and receive it from, please contact our Data Protection Manager at dpm@beyond-lettings.co.uk

15.2     If you have any questions about this Privacy Notice, you can write to our Data Protection Manager at 80 Brudenell Road, Leeds, LS6 1EG. Alternatively, you may telephone us on 0113 487 1573.